Cozystack v1.7.0-alpha.1

Preview build cut from main at 67b4e23. This is an alpha, not a release candidate: it is never promoted to a stable release and it carries no upgrade guarantee. 174 pull requests have landed on main since v1.6.0 — 29 features, 84 fixes, 4 of them breaking. The list below is a selection, not the full set.

Highlights

Worker pools become first-class objects

The kubernetes chart is now control-plane only. Worker pools moved out to their own KubernetesNodes resources, and migration 52 adopts existing pools on upgrade (#3315). Once a pool is its own object it can carry its own settings, and several arrived immediately: a node group can set the CPU request (#3862) and CPU limit (#3859) of its worker VMs, log the guest serial console (#3637), and route worker image pulls through a registry mirror (#3575).

ComputePlane — managed isolation for untrusted code

A new tenant module that provisions a single-tenant, Cozystack-managed cluster for catalog applications that execute user code (#3280), implementing the compute-plane design proposal. It is operator-owned: the Kamaji control plane, the KubeVirt-VM workers and the enablement addons are fixed by the module, so a tenant gets the isolated environment without owning the wiring. Turned on with the computeplane tenant toggle.

PostgreSQL point-in-time recovery

PITR is now a supported and tested capability of the backups.cozystack.io API rather than something an operator assembles by hand (#3383). A recovery target that lies past the end of the archive fails with a precise reason instead of a generic timeout, so a mistyped timestamp is diagnosable in seconds. MongoDB gains a native psmdb backup-strategy driver in the same API (#3562).

The dashboard opens on the Console

Visiting the dashboard now lands on the Console — what the tenant already runs — instead of the Marketplace landing page (#3928). The Marketplace becomes an ordinary destination one click away, and tenant-wide administration moves into the Admin portal. The Tenants page shows the tenant hierarchy, and External IPs are listed across every accessible tenant.

Tenant CA trust anchors across the catalog

The application CA is extracted into a key-free tenant Secret (#3407) and published as a ca.crt-only trust anchor by NATS (#3340) and Qdrant (#3341). MongoDB gets operator-managed TLS with external hostname SANs (#2692), the ClickHouse backup sidecar can trust a private S3 CA (#3385), and the Keycloak KMS proxy a private Vault CA (#3874).

Opt-in east-west encryption

networking.encryption.enabled turns on in-cluster transport encryption for the active datapath (#2984). It maps to KubeOVN's overlay IPsec, whose controller provisions the CA and per-node certificates through the Kubernetes CSR API — no cert-manager wiring, no per-application changes, pod-to-pod traffic encrypted whether or not the workload speaks TLS. Off by default.

No AGPL payload left in the tree

The FluxCD tenant addon (#3379) and the rebuilt Grafana image (#3378) were the last AGPL-3.0 content shipped by this Apache-2.0 repository, and both are gone. The addon is removed outright; Grafana now runs on the digest-pinned upstream image with signed catalog plugins installed at startup, which is possible because the VictoriaLogs datasource — the only reason for the rebuild — is now published in the official catalog.

kube-ovn builds in-tree

packages/system/kubeovn now pulls the upstream chart and builds its image in the monorepo, shaped like packages/system/cilium, retiring the cozystack/kubeovn-chart wrapper repository (#3460). One repository fewer, one release step fewer, and provenance a reader can follow without leaving the tree.

Breaking changes

• spec.nodeGroups is removed from the Kubernetes CR (#3315). Worker pools, their health checks and the autoscaler provision-time budget now live on separate KubernetesNodes resources. Migration 52 adopts existing pools on upgrade.
• The addons.fluxcd option of the Kubernetes app is removed (#3379). Tenant clusters that had it enabled keep their running Flux release; the companion migration carries the upgrade path.
• Multus stages reference CNI plugins into the host /opt/cni/bin (#3195), gated on the new networking.stageCniPlugins value and on for both bundles. Where staging is on the install is unconditional — a plugin is replaced on every pod recreation.
• ApplicationDefinition release prefixes must be dot-free (#3411), constrained to ^[a-z0-9-]*$. A definition whose prefix carries a dot is rejected at admission and must be corrected before the CRD is applied.

Also in this build

• ClickHouse exposes a configurable version parameter (#3476).
• The Redis operator moves from the archived spotahome project to the freshworks-oss fork (#3406).
• Gateway API listeners advertise HTTP/2 via ALPN (#3398).
• ingress-nginx moves to controller v1.11.5 with the admission webhook restricted to the API server (#3798); the same restriction lands for the kube-ovn webhook (#3955).
• CloudNativePG is aligned to 1.30.0 (#3951), and an in-place PostgreSQL restore re-bootstraps instead of wedging (#3959).
• etcd members spread across nodes by default via soft pod anti-affinity (#3962).
• A failed tenant install — monitoring, gateway, etcd, seaweedfs, CNI, CSI, Harbor's nested system — is now retried in place instead of being uninstalled and recreated (#3630, #3633, #3621, #3552, #3581).
• On the release side, cutting a release candidate now freezes the line into release-X.Y, so what a candidate validates is what ships (#3399).

Try it

:::bash
helm upgrade --install cozystack \
  oci://ghcr.io/cozystack/cozystack/cozy-installer --version 1.7.0-alpha.1 \
  -n cozy-system --create-namespace

The Talos node image for this build is attached to the release page as nocloud-amd64.raw.xz.

Full changelog: https://github.com/cozystack/cozystack/compare/v1.6.0...v1.7.0-alpha.1